Memory leak analysis

. Preparation tool: WINDBG2. Prepare the environment: you need to set the WinDbg symbol path

Memory Leak Analysis Demo

[CPP]View Plaincopy

1. int _tmain (INTARGC, _tchar* argv[])
2. {
3. While (TRUE)
4. {
5. char *p = newchar[1024];
6. memset (p, 0, 1024);
7. Sleep (1000);
8. }
9. return 0;
10. }

3. Using the tool UMDH (User-mode dump heap) Analysis UMDH tool: http://msdn.microsoft.com/en-us/windows/hardware/hh852365
3.1 Setting the Gflags.exe flag

R

When the GFLAGS flag is set, turn on CMD.

Type the program to locate the memory leak gflags.exe/i Memroyleak.exe (program name) +ust

After success, open the Memoryleak.exe program

3.2 Creating a heap snapshot with UMDH

Command format: Umdh–pn:memoryleak.exe (program name) –f:snap1.log (log name)

Memoryleak.exe exits when the program is running for a period of time, or when the program consumes more memory .

Then create the heap snapshot again, the command line is no different, snap1.log to Snap2.log or something else.

Set the symbolic path of the program, such as

You can start analyzing the differences between the two snapshots before and after the heap is set up.

Parse diff command: umdh–d snap1.log snap2.log–f:result.txt

View results when analysis is complete result.txt

Red for UMDH location out of the leak point, we're looking at the source code

So that we can modify the memory in the code where the leak.

4.Windbg manually analyze memory leaks 4.1 Global flag settings, reference 3.14.2.Windbg debug leaks

Open the Memoryleak.exe program, WinDbg attach to the process

Command:!heap–s view of all heaps running on the current process

Then F5 let the program run for a period of time or the memory is significantly increased to see the current heap changes again by!heap–s

Such as

By comparing the changes in the front and back two heaps, it was found that the heap 0x012800000 the address increased quickly and the other heaps did not change much.

Further positioning below

Command:!heap–stat–h View the status of the response, the memory of the heap is basically occupied by a block of 0x424 length, and then we search the heap for which modules in the process occupy 0x424-length memory, as

Command:!heap–flt s 424

The heap found by the search program in memory is a large number of 424 heaps, which are used for further viewing by who is using this address

Find the leak point, the red part, if the program corresponds to the symbol corresponding we can see the memory leak point in which line

Memory leak analysis is over, if you have any good ways to share

Memory leak analysis